Between December 1 and December 15, 2025, WordPress 6.9 shipped with block level Notes, a dashboard wide Command Palette and the new Abilities API, and WooCommerce 10.4 made the Interactivity API Mini Cart the default, followed by 10.4.1 and 10.4.2. On the platform side, Apache httpd 2.4.66, Capacitor 8 and Android 16 QPR2 shipped, iOS 26.2 fixed two WebKit flaws Apple says may have been exploited, and Angular fixed a stored XSS. Act on this first: WooCommerce stores should land on 10.4.2, and phones used for site work should be on iOS 26.2.
Below is a quick summary table, then a section for each release covering what shipped, what it means for you, how we use it in WordPress builds, what it means for mobile apps and what to do next. Each WordPress core release gets a short summary here and a link to its own post.
At a glance
| Release | Date | Type | Who should care | Action |
|---|---|---|---|---|
| WordPress 6.9 | Dec 2 | Feature | Every WordPress site, especially sites with custom blocks | Test, then update |
| WooCommerce 10.4 | Dec 10 | Feature | Every WooCommerce store, especially stores with a customized Mini Cart | See standalone post |
| WooCommerce 10.4.1 and 10.4.2 | Dec 12 | Fix release | Every store on 10.4 | Update to 10.4.2 |
| Angular security advisories | Dec 1 | Security | Angular, Ionic Angular and SSR front ends | Update Angular packages |
| Android 16 QPR2 | Dec 2 | Platform release | Android app owners | Review SDK setup |
| Apache httpd 2.4.66 | Dec 4 | Security | Sites on Apache | Update to 2.4.66 |
| Capacitor 8 | Dec 8 | Major release | Hybrid app teams | Upgrade on a branch |
| iOS 26.2 | Dec 12 | Security | Every iPhone and iPad user | Update devices |
WordPress 6.9: Notes, Command Palette and the Abilities API
WordPress 6.9, code named "Gene", was released on December 2, 2025, with block level Notes for editorial review, a Command Palette that works across the whole dashboard and the new Abilities API for automation and AI powered workflows. It also added beta support for PHP 8.5, while PHP 7.2 and up remain supported. Test themes, custom blocks and key plugins on staging, then update.
For the full write up, read our standalone post: WordPress 6.9: Notes, Command Palette and the New Abilities API.
WooCommerce 10.4
WooCommerce 10.4 was released on December 10, 2025, and raises the minimum WordPress version to 6.8, with PHP 7.4 still the minimum. It makes the Interactivity API Mini Cart the default, loads the analytics REST namespaces only when a request needs them and moves HPOS datastore caching out of experimental status.
For the full write up, read our standalone post: WooCommerce 10.4.
WooCommerce 10.4.1 and 10.4.2 fixes
What shipped
WooCommerce 10.4.1 was rolled into 10.4.2, released on December 12, 2025. It stops browsers from caching Store API cart responses that left the Interactivity API Mini Cart showing stale contents, reverts an HPOS sync on read optimization that triggered unnecessary order saves and affected plugins such as Jetpack Sync, removes PHP notices on fresh installs, fixes a MailPoet form conflict in block themes and fixes a Product Editor crash on WordPress 6.9.
What it means for you
A Mini Cart that shows the wrong items costs sales, so a store should land on 10.4.2 rather than stopping at 10.4.0. Stores that run Jetpack Sync or similar plugins also avoid the extra order saves.
How we use it in WordPress builds
After updating we add, update and remove items from the header cart on staging and confirm the Mini Cart shows the right contents on a cached page. We also check order logs for repeat saves.
What it means for mobile apps
AppPresser store apps that show the cart read the same Store API, so we add and remove items in the app after the update to confirm the cart stays in sync.
What to do next
- Update to WooCommerce 10.4.2.
- Clear page and object caches, then test the Mini Cart.
- Let our support and maintenance team run the update and checks for you.
Angular security advisories
What shipped
The Angular team published these security advisories in this period:
- CVE-2025-66412 (high): stored XSS through SVG animation, SVG URL and MathML attributes, in @angular/compiler
What it means for you
These flaws are in the Angular framework, not in WordPress. They matter if you run an Angular front end, an Ionic Angular app or server side rendering in front of WordPress.
How we use it in WordPress builds
On headless WordPress front ends built with Angular, we update the @angular packages to the fixed version for the project's major line and rerun rendering, login and form tests.
What it means for mobile apps
Ionic Angular apps ship Angular inside the app, so a fix for code that runs in the app needs a rebuild and a new store submission.
What to do next
- Update to Angular 21.0.2, 20.3.15 or 19.2.17 or later.
- Ask our mobile app team to rebuild and resubmit an affected app.
Android 16 QPR2 adds the first minor SDK version
What shipped
Google released Android 16 QPR2 on December 2, 2025. Google's announcement says:
- It is the first Android release with a minor SDK version, API level 36.1
- Changes are mostly additive, and behavior changes focus on security and accessibility, such as SMS one time password protection
- Apps that want the new APIs compile against release(36) with minorApiLevel set to 1
What it means for you
Most apps keep working as they are. Apps that read SMS codes should test the new one time password protection.
How we use it in WordPress builds
WordPress sites that send login codes by SMS should confirm the codes still reach users on Android 16 QPR2 devices.
What it means for mobile apps
We test AppPresser apps on an Android 16 QPR2 device before the next store submission and only raise the compile setting when an app needs the new APIs.
What to do next
- Test SMS based login and verification flows on Android 16 QPR2.
- Plan any compile setting change with your next app update.
Apache httpd 2.4.66 Fixes Five Vulnerabilities in SSI, suexec and mod_md
What shipped
The Apache HTTP Server project released 2.4.66 on December 4, 2025. The security fixes:
- Apache httpd 2.4.66 was released December 4, 2025 with fixes for 5 CVEs (3 moderate, 2 low).
- CVE-2025-58098: with SSI and mod_cgid, the query string was passed to #exec cmd.
- CVE-2025-66200: a mod_userdir plus suexec bypass.
- CVE-2025-59775: on Windows, an SSRF that could leak NTLM hashes through UNC paths.
- CVE-2025-55753 (mod_md ACME retry) and CVE-2025-65082 (CGI environment override) were also fixed.
What it means for you
None of the five issues is rated important, but two touch features shared hosts still turn on: server side includes and per user directories. If your server uses either, this update closes a path for running commands or bypassing suexec.
How we use it in WordPress builds
Most WordPress sites we host do not need SSI or mod_userdir, so we keep both modules off. That removes the risk from these issues, though we still apply the patched build so the server is current.
What it means for mobile apps
Apps that pull content from a WordPress site on Apache are not directly affected. The app talks to the REST API, which these fixes do not change, so no app update is needed.
What to do next
Confirm your host is on 2.4.66 or later and that unused modules such as mod_userdir and mod_include are disabled. Our WordPress security and hosting plans include this kind of server patching.
Capacitor 8 Makes Swift Package Manager the Default and Adds Android Edge to Edge
What shipped
Ionic released Capacitor 8 on December 8, 2025. The main changes:
- Ionic announced Capacitor 8 on December 8, 2025.
- New iOS projects use Swift Package Manager by default instead of CocoaPods; existing CocoaPods projects keep working.
- Android edge to edge support is built in through an internal SystemBars plugin.
- A new public SystemBars API controls the system bars from app code.
- An update guide covers the move from Capacitor 7.
What it means for you
Capacitor is the native layer under many hybrid apps. Version 8 changes how iOS dependencies are installed for new projects and how Android apps draw behind the status and navigation bars.
How we use it in WordPress builds
Capacitor does not touch WordPress itself. The WordPress side stays the same, and the REST API endpoints the app calls do not change.
What it means for mobile apps
AppPresser apps are built on Capacitor, so this is a platform upgrade for every app. Edge to edge layout matters on Android because newer Android versions expect it, and screens need safe area padding so headers do not slide under the status bar.
What to do next
Upgrade a test build to Capacitor 8 using the official update guide and check every screen on Android for content under the system bars. Our custom mobile app team handles Capacitor upgrades for AppPresser clients.
iOS 26.2 fixes exploited WebKit flaws
What shipped
Apple released iOS 26.2 and iPadOS 26.2 on December 12, 2025. Apple's security notes list:
- At least 36 CVE IDs
- Two WebKit issues, CVE-2025-43529 and CVE-2025-14174, that Apple says may have been exploited in targeted attacks on versions before iOS 26
What it means for you
WebKit is the engine behind Safari and every in app web view on iPhone, so these flaws could be reached by loading a web page.
How we use it in WordPress builds
WordPress itself does not change. Many visitors reach your site in Safari on iPhone and iPad, so their device updates protect them while they browse and buy.
What it means for mobile apps
AppPresser apps run inside iOS, so an iOS security fix protects your app users as soon as they update. No new app build is needed for this release.
What to do next
- Update team and test devices to iOS 26.2 or later.
- Ask staff who handle site admin work on iPhone to update first.
How AlphaWeb handles updates for you
Two feature releases in the same two weeks, from WordPress and WooCommerce, is a lot of change at once, which is why testing them together on staging matters. Our support and maintenance plans cover tested WordPress core, theme and plugin updates on staging first, then in production, with uptime monitoring and help when something breaks. Our WordPress security and hosting service keeps PHP versions and servers current, and our custom WordPress development and custom mobile apps teams put new features to work when they fit.
We also track the server, app platform and payment releases behind your site and app, including Angular, Android, Apache, Capacitor and iOS. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Request a custom development quote, or tell us about your project through our Mission Brief.
Frequently asked questions
Should Capacitor 8 and the Apache 2.4.66 update happen together?
No. They are separate. The Apache update is a server patch your host can apply right away. Capacitor 8 is an app upgrade that needs a test build and a store release. Our mobile app team handles the app side.
Do we need a new app build for an iOS security update?
No. iOS security fixes are installed by each user on their device. Your app keeps working and is protected once the device updates.
Brief Us on Your Mission
Want to talk about a website, mobile app, migration or AI project? Fill out the Mission Brief and a specialist will follow up to schedule a call and put together a free quote.
